#1
Member
Profile: Join Date: Aug 2008
Posts: 3
Computer Experience:
Crazy Malware
Hey everyone, SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.google.ca/ http://favorites.live.com/quickadd.aspx http://go.microsoft.com/fwlink/?linkid=39204 http://messenger.zone.msn.com/binary...r.cab56986.cab http://messenger.zone.msn.com/EN-CA/.../GAME_UNO1.cab http://www.worldwinner.com/games/v46.../bejeweled.cab http://www.worldwinner.com/games/shared/wwlaunch.cab http://messenger.zone.msn.com/binary...o.cab56649.cab http://messenger.zone.msn.com/binary...t.cab56907.cab http://messenger.zone.msn.com/binary...r.cab56986.cab http://www.shopmotorola.ca/red/images/red.jpg
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Welcome to WindowsBBS raniosman here , saving the file to your desktop. If you cannot save it or run it, try renaming it to something else prior to saving (or attempting to save).this link for your applicable programs.Close all open programs and windows Double click combofix.exe and follow the prompts.
It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
#3
Member
Profile: Join Date: Aug 2008
Posts: 3
Computer Experience:
Sorry about the delay, the website you gave me to download combofix was on the malwar's "thou shall not visit" list hehe, had to use my laptop to download it, move it here via usb drive, and rename it BKcombo.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! Ad -Aware SE Professional\\Ad -Aware.exe"=http://www.gmer.net
#4
Member
Profile: Join Date: Aug 2008
Posts: 3
Computer Experience:
Here is hijackthis's log:SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.google.ca/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://favorites.live.com/quickadd.aspx http://go.microsoft.com/fwlink/?linkid=39204 http://messenger.zone.msn.com/binary...r.cab56986.cab http://messenger.zone.msn.com/EN-CA/.../GAME_UNO1.cab http://www.worldwinner.com/games/v46.../bejeweled.cab http://www.worldwinner.com/games/shared/wwlaunch.cab http://messenger.zone.msn.com/binary...o.cab56649.cab http://messenger.zone.msn.com/binary...t.cab56907.cab http://messenger.zone.msn.com/binary...r.cab56986.cab http://www.shopmotorola.ca/red/images/red.jpg
#5
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Please download Flash_Disinfector by sUBs and save it to your desktop:Plug in your USB flash drive.
Double-click Flash_Disinfector.exe to run it.
Follow any prompts that may appear.
Your desktop will vanish for a while, and then reappear. This is normal.
Wait until the program has finished scanning, then please exit the program. If you use more than 1 flash drive, run the tool with each plugged in.
contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
http ://www.windowsbbs.com/malware-virus-removal/75843-crazy-malware.html#post410339
Suspect::[22]
C:\WINDOWS\winstart.bat
Collect::[22]
C:\WINDOWS\system32\lawin.exe
C:\WINDOWS\system32\cysume.exe
C:\WINDOWS\system32\rywvvhoy.exe
C:\WINDOWS\system32\izcalm.exe
C:\WINDOWS\system32\pkjcbdkplduw.exe
C:\WINDOWS\system32\eyyzrqpuuayky.exe
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"roocouvok"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"roocouvok"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Miiy]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0b882a5a-0847-11dd-9b4b-0040f45e1048}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e147771e-2551-11dd-9b62-0040f45e1048}]
Driver::
tiana3sfyyehy3j Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
All times are GMT +1. The time now is 00:17 .
